<?php
include("functions.inc.php");

if(!preg_match('/^[a-z_]+/i',$_GET['data']))
	die();

if(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST) <> $_SERVER['HTTP_HOST'])
die();

dbConnect();
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); 
header("Cache-Control: no-cache"); 
header("Pragma: no-cache");
header("Content-type: text/xml");


if(!preg_match('/^[a-z_]+/i',$_GET['data']))
	die();

$dom = new DOMDocument('1.0', 'utf-8');
$content = $dom->createElement('content');

switch($_GET['data']){
	case 'comuni':
		
		$prov_id = intval($_GET['v']);
		if($prov_id == 0)
			die();
		
		$result = $mysqli->query("SELECT * FROM comuni WHERE provincia_id = ".$prov_id." ORDER BY comune");
		while($row = $result->fetch_assoc()){
			$xrow = $dom->createElement('row');
			$xrow->setAttribute("v",$row['comune_id']);
			$xrow->appendChild($dom->createTextNode(utf8_encode($row['comune'])));
			$content->appendChild($xrow);
		}
		
	break;
	
	case 'gruppi':
	case 'sottogruppi':
		
		if($_GET['data'] == 'sottogruppi'){
			$rif_id = intval($_GET['v']);
			if($rif_id == 0)
				die();
			$w = "rif_id = ".$rif_id;
		}else{
			$w = "rif_id = 0 AND serv_cod = ".dbClean($_GET['v']);
		}
	
		$result = $mysqli->query("SELECT * FROM gruppi WHERE ente_id = ".$_SESSION['user']['ente_id']." AND ".$w." ORDER BY grp_nome");
		while($row = $result->fetch_assoc()){
			$xrow = $dom->createElement('row');
			$xrow->setAttribute("v",$row['grp_id']);
			$xrow->appendChild($dom->createTextNode(utf8_encode($row['grp_nome'])));
			$content->appendChild($xrow);
		}
		
	break;
}

$dom->appendChild($content);
echo $dom->saveXml();
?>